Critical Firmware Flaw Hits Charging Units

CVE-2026-44104 describes a critical vulnerability in the firmware update process of the basemodule for the charging controller. Because the system performs no cryptographic signature verification, an unauthenticated remote attacker can successfully install modified firmware, leading to full system compromise.

What's at Risk

The vulnerability affects the basemodule component of the charging controller. Organizations utilizing these controllers in internet-facing configurations are at the highest level of risk. When industrial or infrastructure hardware lacks proper authentication for firmware updates, the device becomes a target for remote takeover, potentially allowing unauthorized control over the hardware functions.

How the Flaw Works

This vulnerability stems from a failure to verify the integrity and authenticity of update packages. In general, firmware update mechanisms rely on cryptographic signatures to ensure that only code authorized by the manufacturer is executed by the device. When a system only checks a CRC32 checksum, it is only verifying that the file was transmitted without corruption, not that the file is legitimate.

Attackers typically exploit this class of weakness by replacing a valid update file with a malicious version. Because the system does not verify the signature, it treats the malicious firmware as a trusted update and proceeds to install it. Once the modified firmware is running, the attacker gains the same level of access as the device operating system, which often includes the ability to bypass security controls, exfiltrate data, or disrupt the operation of the hardware itself.

How to Protect Your Systems

• Review the official advisory from the vendor to identify the specific firmware versions that address this lack of signature verification.
• Apply the latest manufacturer-provided patches immediately to ensure cryptographic verification is properly implemented.
• Restrict network access to charging controller management interfaces to prevent unauthenticated remote access.
• Isolate critical infrastructure components from the public internet using firewalls or dedicated management networks.
• Monitor device logs for unauthorized firmware update attempts or unexpected configuration changes.

Given the critical 9.8 CVSS score, the potential for full system compromise is significant. Organizations should prioritize the deployment of vendor-supplied patches to close this security gap, as the absence of signature verification leaves the device entirely vulnerable to remote manipulation of its core functionality.